Quantum random number generator based on the photon number decision of weak laser pulses 
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We propose an approach to realize a quantum random number generator (QRNG) based on the photon number 
decision of weak laser pulses. This type of QRNG can generate true random numbers at a high speed and can 
be adjusted to zero bias conveniently, thus is suitable for the applications in quantum cryptography. 



Random numbers are essential in a very wide application 
range, such as statistical sampling [1], computer simulations 
f^, randomized algorithm |3] and cryptography |4|. In the ap- 
plication of quantum cryptography, true random numbers are 
required for the secure key distribution. Current theory im- 
plies that the only way to realize a random number generator 
(RNG) which can be scientifically proved to be undeterminis- 
tic is to use the intrinsic randomness of quantum decisions, for 
the occurrence of each possible result is unpredictable. Some 
practical methods to realize a quantum random number gen- 
erator (QRNG) have been proposed: single photons incident 
on a 50:50 beam splitter [5]; polarized single photons incident 
on a rotatable polarizing beam splitter |5] or Fresnel multi- 
ple prism |6]; and utilizing the random time intervals between 
photon emissions of semiconductors [7]. Since no practical 
single photon source exists nowadays, the QRNGs based on 
single photons usually use weak laser source to approximate 
the single photon source. Consequently, the generation rate 
of random numbers is restricted by the probability of single- 
photon component in laser pulse. In this Letter, we propose 
an approach for randomness generation based on the photon 
number decision of weak laser pulses. This type of QRNG 
can generate one random bit for each random event and it can 
be conveniently adjusted to the state of generating ones and 
zeros with equal probabilities. Besides, it has a more compact 
set up. Those advantages make it suitable for the applications 
of quantum cryptography. 

We define a random bit generator as a device which pro- 
duces bits independently of each other and with equal prob- 
abilities of ones and zeros, i.e., p(0) = p{\) - 0.5. Normally, 
the photon number distribution of weak laser pulses is Pois- 
sonian [8]. Since the photon number distribution of partially 
absorbed light follows a Bernoulli transform of the initial field 
|j9], the detected photon number distribution of weak laser 
pulses follows 
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where A is the mean photon number of the weak laser pulses, 
rj is the detection efficiency of the single photon detector 
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Experimentally, we use an avalanche photodiode (APD) op- 
erating in gated mode in the measurement, which does not 
distinguish the photon numbers above zero photons. In 
this situation, we get the result '0' when the pulse con- 
tains no photon, and the result '1' when above zero pho- 
ton. Hence, the probabilities of getting results of '0' and ' 1 ' 
are P,j(Q) - e"'''', P;,(l) = 1 - e"'''', respectively. We then have 
p^(0) = f ,(1) = 0.5, when t]A = 0.693. Since 77 is a specifi- 
cation of the detector, we can simply adjust A to set rjA to 
the proper value (0.693). Concerning that the probabilities of 
generating ones and zeros are equal and each generation is 
independent, the outcome of the QRNG is true random. 

The experimental set up of our QRNG is shown in Fig. [1] 
We use a pulsed laser source (PLS, id300, produced by id 
Quantique) to generate laser pulses of 300 ps at 1550 nm ac- 
cording to external trigger. First, the controlling system gen- 
erates an NIM signal of 1 MHz to trigger id300. The emerg- 
ing laser pulses are coupled into single mode fiber (SMF) and 
then pass through a mechanically adjustable attenuator Fi- 
nally, the pulses are detected by the single photon detector 
module (SPDM, id200, produced by id Quantique). The mod- 
ule of id200 is based on an InGaAs APD working in gated 
mode, where a voltage pulse is applied to raise the bias above 
breakdown upon triggering. If there are photons detected dur- 
ing a gate, the SPDM will output a logic ' 1 ' signal after the 
gate, otherwise the response will be logic '0'. We set the dead 
time of id200 as zero and the gate width as 2.5 ns. The con- 
trolling system generates a TTL trigger signal for id200 with 
a proper delay from the trigger of id300. The dark count rate 
is measured to be 10"^ in experiment, and the detection ef- 
ficiency is no less than 10 percent according to the features 
provided by id Quantique. The average power of id300 at 1 
MHz is -35 + 1 dBm according to the specifications. Taking 
the detection efficiency of id200 as 0.1, the average photon 
number after the attenuation should be 6.93. Since the trans- 
mi ttance of the attenuator can be continuously adjusted from 
to -30 dB, the probabilities of generating ones and zeros can 
be practically adjusted to be equal. The output of the SPDM 
is recorded and transferred to PCI-7300A (PC interfaced data 
acquisition board, produced by ADLINK Technology Inc.) by 
the controlling system. In order to eliminate the errors due to 
the clock drift between PCI-7300A and id200, the control- 
ling system accompanies the data signal with a synchronizing 
clock. We develop the controlling system based on a chip of 
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FIG. 1: (color online) Schematic experiment set up for our QRNG. 
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FIG. 2: (color online) The operation (clock to clock) of our QRNG. 



Cyclone II EP2C5T144C8 (FPGA, produced by Altera). The 
peak power of the laser source is dBm according to the spec- 
ifications provided by id Quantique. It is much less than the 
10 dBm damage level of the SPDM. First, we apply a rela- 
tively weak attenuation to the emitted laser pulses so that al- 
most every pulse can be detected by the SPDM. We scan the 
delay between the trigger of the laser and the detection gate to 
find the maximum count rate, which means the detection gate 
catch the laser pulses. After finishing the synchronization of 
the experimental system, we adjust the mechanical attenuator 
delicately to make the photon count rate approach to half of 
the repetition rate of the laser pulses. We fix the attenuator 
at the best point and find that our QRNG is thus set up. The 
operation (clock to clock) of our QRNG is illustrated schemat- 
ically in Fig.E] The QRNG described above can be compared 
with an ideal random number generator, which produces ones 
and zeros with equal probability and every bit is totally inde- 
pendent of the previous ones. According to jlOtl . the serial 
correlation coefficient of the sequence Yi... with lag 
^ > 1 is defined as 
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(Y, - Y)(Yi^k - Y) 
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where and Y are the length and the mean of the sequence, 
respectively. The coherence time of the laser is about Ops 
according to its spectral width of 0.6nm. Time interval be- 
tween two consecutive laser pulses is much lager than the co- 
herence time for the repetition rate within 10 GHz. Thus the 
photon decision of each pulse is totally independent. When 
the probabilities of generating ones and zeros are equal, 
should approach to zero. However, there always exists the 
after pulse effect for real SPDs, which means that the SPD 
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FIG. 3: (color online) Serial correlation coefficient (a^) of a typical 
sequence of 10' bits, with the lag k ranging from I to 100. 



would generate an electrical pulse with a certain probability 
within a gate period if it detects photons in the previous gate. 
The after pulse effect obviously introduces correlations to the 
binary sequence generated by the SPD. For a typical sequence 
of 10^ bits, we calculate with k ranging from 1 to 100, the 
results of which are plotted in Fig. [3] It can be seen that ajt is 
relatively high for k < 6 due to the after pulse effect. Hence, 
for the true randomness, we should select the random bit with 
an interval of more than 6 bits. Another modification of our 
QRNG is the non-equal probabilities of ones and zeros. It can 
be described by the bias b which is defined as b = P{0) -1/2. 
The bias of our QRNG varies with the detected mean pho- 
ton number, which is dominated by the detection efficiency of 
SPD, the transmittance of attenuator, and the power of laser 
The average of detected photon number Ad can be written as 



Ad 



hvofr 
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where Pat.g is the average optical power, vq is the central fre- 
quency of the pulsed laser, h is Planck's constant, T is the 
transmittance of the attenuator, rj is the detection efficiency of 
the SPD, and frep is the repetition rate of the laser. In exper- 
iments, a feed forward loop can be built to ensure the long 
term stability of Ad- Thus, the bias is restricted to zero phys- 
ically. Further more, the original bits could be unbiased with 
appropriate mathematical procedures |11, 12]. 

So far, there is no generally accepted definition of absolute 
randomness. In the applications of quantum cryptography, the 
most desired feature of RNG is its impossibility of descrip- 
tion or prediction. This can only be proved by recording the 
outcome of the RNG for infinite time. However, only finite 
samples are practically possible. Many empirical methods are 
thus proposed to test RNG with sequences of finite length. 
Though these empirical methods are not sufficient for the test 
of the true randomness, they may detect some imperfections 
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TABLE I: Results of ENT for a typical sequence of 10' bits 

Entropy = 1.000000 bits per bit. 

Optimum compression would reduce the size 

of this 1025999992 bit file by percent. 

Chi square distribution for 1025999992 samples is 2.07, and 

randomly would exceed this value 15.00 percent of the times. 

Arithmetic mean value of data bits is 0.5000 (0.5 = random). 

Monte Carlo value for Pi is 3.140925340 (error 0.02 percent). 

Serial correlation coefficient is 0.000312 (totally uncorrelated = 0.0). 



TABLE II: Results of DIEHARD for a typical sequence of 10' bits 


Birthday Spacings 


0.443957 


Overlapping Permutations 


0.467282 


Ranks of 31x31 Matrices 


0.988764 


Ranks of 32x32 Matrices 


0.364029 


Ranks of 6x8 Matrices 


0.359226 


Monkey Tests on 20-bit Words 


0.31820 


Monkey Test OPSO 


0.2027 


Monkey Test OQSO 


0.5306 


Monkey Test DNA 


0.3234 


Count 1 's in Stream of Bytes 


0.543339 


Count I's in Specific Bytes 


0.684855 


Parking Lot Test 


0.165163 


Minimum Distance Test 


0.501530 


Random Spheres Test 


0.356525 


The SQEEZE Test 


0.716755 


Overlapping Sums Test 


0.437118 


Runs Test (up) 


0.777892 


Runs Test (down) 


0.854107 


The Craps Test No. of wins 


0.808609 


The Craps Test throws/game 


0.511087 



of the random numbers. We choose two batteries of statistical 
tests to evaluate our QRNG: ENT and DIEHARD, which we 
consider to be sufficient in qualifying the device for its use in 
the experiment. 

ENT ifTsIl is a series of basic statistical tests which evalu- 
ate the random sequence in some elementary features such as 



the equal probabilities of ones and zeros and the serial cor- 
relation. The testing results of a typical sequence of 10^ bits 
are presented in Table H] From the results, we can see that our 
QRNG generates ones and zeros with almost equal probabil- 
ity. The serial auto-correlation coefficient is of the order of 
10 which is due to the after pulse effect. In the standard 
ENT test, the Monte Carlo estimation for n actually evaluates 
the uniform distribution of blocks of 48 bits. 

To further exploit some subtle imperfections hidden in our 
QRNG, we test the sample sequence using DIEHARD Hill . 
DIEHARD is widely considered as one of the best strength- 
ened randomness testing battery because it is most sensitive 
to various problems possible in pseudo RNG. It consists of 15 
tests with outcome of one or more p-values. According to the 
instruction of the testing suit, a sequence could not be consid- 
ered as random if p-value is less than 0.01 or greater than 0.99 
for six or more places. The testing results of the sequence of 
1 X 10^ bits are shown in Table HH from which one can find 
that our QRNG generates true random numbers. 

We present an approach of QRNG based on the photon 
number decision of weak laser pulses. The realization of it 
consists of a pulsed laser source, a flexible attenuator, a single 
photon detector, and some circuits used for controlling and 
data acquisition. This type of QRNG has advantages for the 
application in quantum cryptography. It can generate random 
numbers at a high speed that is limited only by the recovery 
time of the single photon detector. If the device is realized 
with fast single photon detectors, e.g., the ones based on sil- 
icon APD, the generation rate of random numbers is hope- 
fully increased to GHz or higher In addition, this type of 
QRNG can be more compact for it needs only one APD pho- 
ton counter. 
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